11 guides · updated 18 Oct 2026
PDPA guides
Singapore's Personal Data Protection Act in plain English: what to collect, how to keep it safe and what to do after a breach.
PDPA
Data Retention Policy for SMEs: How Long to Keep Personal Data
How long Singapore SMEs may keep personal data under the PDPA: the Retention Limitation Obligation, legal minimums, a sample schedule and how to delete.
ReadPDPA
How to Handle a PDPA Access Request: Steps, Deadline and Fees
Customer asked for their personal data? How to handle a PDPA access request: verify identity, the 30-day timeline, fees, exceptions, CCTV and a reply outline.
ReadPDPA
PDPA Fines in Singapore: How Much and What SMEs Get Fined For
PDPA penalties explained: up to S$1 million or 10% of Singapore turnover, how PDPC sets the amount, and what past decisions involving small firms show.
ReadPDPA
Do Not Call Registry: How to Check Numbers Before SMS or WhatsApp
Singapore Do Not Call Registry for businesses: when you must check numbers before SMS, calls or WhatsApp marketing, the 21-day rule, fees, consent and the API.
ReadPDPA
Data Protection Trustmark (DPTM): Cost, Process, Is It Worth It?
What the Data Protection Trustmark (DPTM, SS 714:2025) involves for a Singapore SME: the four clauses, certification bodies, what drives cost and grant support.
ReadPDPA
CCTV and the PDPA: Rules for Shops, Offices and Clinics
CCTV under Singapore's PDPA: when you need consent or notices, staff cameras, footage access requests and masking, retention, and securing your DVR or NVR.
ReadPDPA
Website Privacy Policy and Cookie Consent Under the PDPA
Does your Singapore website need a privacy policy and a cookie banner? What the PDPA requires for forms, analytics and ad cookies, with a step-by-step setup.
ReadPDPA
PDPA Data Breach Notification: The 3-Day Rule Explained
When a data breach must be reported to the PDPC, how the 3-calendar-day deadline works, who else to notify, and a step-by-step plan for small businesses.
ReadPDPA
Can Your Business Collect NRIC Numbers? The PDPA Rules
When a Singapore business may collect NRIC numbers or copies, why NRIC must not be used as a password, partial NRIC rules, and alternatives for your forms.
ReadPDPA
How to Appoint a Data Protection Officer (DPO) in Singapore
Is a DPO mandatory in Singapore? Who can be your DPO, what they do, and how to register them with the PDPC now that BizFile+ no longer takes DPO details.
ReadPDPA
PDPA Checklist for Small Businesses in Singapore (Printable)
A plain-English PDPA checklist for Singapore SMEs: DPO, privacy notice, consent, data inventory, retention, security, breach plan and DNC. Linked to PDPC.
Read